diff --git a/APP/Dockerfile b/APP/Dockerfile
index 2fe0595..1f08d17 100644
--- a/APP/Dockerfile
+++ b/APP/Dockerfile
@@ -4,11 +4,14 @@ WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci --legacy-peer-deps
 COPY . .
-# Kendo Angular license: passed in as a build-arg (sourced from a Gitea Actions
-# secret), exposed to `npm run build` as the env var kendo-licensing reads. Not
-# baked into any image layer beyond this build stage (the runtime stage is nginx).
+# Kendo Angular license: passed in as a build-arg (from a Gitea Actions secret).
+# kendo-licensing v20 needs the key activated at build time. We both export the
+# env var AND run `kendo-ui-license activate`, which validates the key and writes
+# the activation kendo-licensing reads during `ng build`. None of this reaches
+# the runtime image (that stage is just nginx + static files).
 ARG KENDO_UI_LICENSE
 ENV KENDO_UI_LICENSE=${KENDO_UI_LICENSE}
+RUN npx kendo-ui-license activate
 RUN npm run build           # -> dist/client-bridge/browser  (production by default)
 
 # ---- runtime ----